diff options
Diffstat (limited to 'drivers/cdrom/cdrom.c')
| -rw-r--r-- | drivers/cdrom/cdrom.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c index 75fb965b8f72..f997c27d79e2 100644 --- a/drivers/cdrom/cdrom.c +++ b/drivers/cdrom/cdrom.c | |||
| @@ -1929,11 +1929,17 @@ static int dvd_read_manufact(struct cdrom_device_info *cdi, dvd_struct *s, | |||
| 1929 | goto out; | 1929 | goto out; |
| 1930 | 1930 | ||
| 1931 | s->manufact.len = buf[0] << 8 | buf[1]; | 1931 | s->manufact.len = buf[0] << 8 | buf[1]; |
| 1932 | if (s->manufact.len < 0 || s->manufact.len > 2048) { | 1932 | if (s->manufact.len < 0) { |
| 1933 | cdinfo(CD_WARNING, "Received invalid manufacture info length" | 1933 | cdinfo(CD_WARNING, "Received invalid manufacture info length" |
| 1934 | " (%d)\n", s->manufact.len); | 1934 | " (%d)\n", s->manufact.len); |
| 1935 | ret = -EIO; | 1935 | ret = -EIO; |
| 1936 | } else { | 1936 | } else { |
| 1937 | if (s->manufact.len > 2048) { | ||
| 1938 | cdinfo(CD_WARNING, "Received invalid manufacture info " | ||
| 1939 | "length (%d): truncating to 2048\n", | ||
| 1940 | s->manufact.len); | ||
| 1941 | s->manufact.len = 2048; | ||
| 1942 | } | ||
| 1937 | memcpy(s->manufact.value, &buf[4], s->manufact.len); | 1943 | memcpy(s->manufact.value, &buf[4], s->manufact.len); |
| 1938 | } | 1944 | } |
| 1939 | 1945 | ||
